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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



ELECTRONIC PRIVACY 
INFORMATION CENTER 
1718 Connecticut Ave., N.W. 
Suite 200 

Washington, DC 20009 
Plaintiff, 



THE UNITED STATES DEPARTMENT 
OF HOMELAND SECURITY 
Washington, D.C. 20528 

Defendant. 



Civil Action No. 



COMPLAINT FOR INJUNCTIVE RELIEF 

1 . This is an action under the Freedom of Information Act ("FOIA"), 

5 U.S.C. § 552, for injunctive and other appropriate relief, seeking the release of agency records 
requested by the Electronic Privacy Information Center ("EPIC") from the United States 
Department of Homeland Security ("DHS"). 

2. This lawsuit challenges DHS' failure to disclose documents in response to EPIC's 
July 26, 201 1 FOIA request ("EPIC's FOIA Request") to DHS. 

3. EPIC's FOIA Request seeks agency records concerning contracts, communications, 
Privacy Impact Assessments ("PI As"), and related documents concerning a program designed to 
monitor Internet traffic routed through Internet Service Providers ("ISPs") from Internet users to 
computer networks operated by defense contractors. 

4. Though EPIC filed EPIC's FOIA request on July 26, 201 1, DHS has failed to 
disclose a single record, and has failed to comply with agency deadlines under the FOIA. In 
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1 addition, the National Protection and Programs Directorate ("NPPD"), a component of DHS, has 
: failed to provide any response to EPIC's FOIA Request. 

5. EPIC asks the Court to order immediate disclosure of all responsive records. 

Jurisdiction and Venue 

6. This Court has subject matter jurisdiction over this action and personal jurisdiction 

! over the parties pursuant to 5 U.S.C. § 552(a)(4)(B) and 5 U.S.C. § 552(a)(6)(C)(i). This Court also 
: has jurisdiction over this action pursuant to 28 U.S.C. § 133 1 . Venue is proper in this district under 

I 5 U.S.C. § 552(a)(4)(B). 

I 

Parties 

7 . Plaintiff EPIC is a public interest research organization incorporated as a not-for- 

: profit corporation in Washington, D.C. EPIC's activities include the review of federal activities and 
I policies to determine their impacts on civil liberties and privacy interests. Among its other activities, 

EPIC publishes books, reports, and a bi-weekly electronic newsletter. EPIC also maintains a 
: heavily visited Internet site, http://www.epic.org, which contains extensive information regarding 

privacy issues, including information EPIC has obtained from federal agencies under the FOIA. 

EPIC routinely and systematically disseminates information to the public. This Court recognized 

EPIC's role as a representative of the news media in EPIC v. Dep 't of Defense, 241 F. Supp. 2d. 5 

(D.D.C. 2003). 

8. Defendant DHS is an agency established in the Executive Branch of the United 
States Government. DHS is an agency within the meaning of 5 U.S.C. § 552(f)(1). DHS includes a 
component called the National Protection and Programs Directorate ("NPPD"). 
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; Facts 

! 
i 

DHS and the National Security Agency Have Instituted a Joint Pilot Program to Monitor 

Internet Traffic to Defense Contractors 

9. In May 20 1 1 , the National Security Agency ( !i NSA") implemented a new pilot 
program to monitor all traffic flowing through certain ISPs from Internet users to a select number of 
defense contractors. The goal of the program is to "thwart[] cyberattacks against defense firms." 

1 0. Deputy Secretary of Defense, William J. Lynn III, asserted that the NS A pilot 
program serves as a model that will be "transported to other critical infrastructure sectors, under the 
leadership of the Department of Homeland Security." 

11. Deputy Secretary Lynn has stated that DHS has an active role in the implementation 
of the program. 

12. NSA monitors ISPs, including AT&T, Verizon, and Century Link, under this 
program. 

1 3 . The program monitors Internet traffic to fifteen defense contractors, including 
Lockheed Martin, CSC, SAIC, and Northrop Grumman. 

14. NSA has stated that the agency developed "signatures" of malicious code as well as 
sequences of suspicious network behavior that it uses to filter all Internet traffic on those ISPs that is 
"flowing" to specified defense contractors. By applying these "signatures" and filtering suspicious 
behavior, NSA claims that it is able to "disable the threats before an attack can penetrate a 
contractor's servers." 

15. Individuals within the Department of Justice ("DO J") have expressed that the 
program could "run afoul of laws forbidding government surveillance of private Internet traffic." 

1 6. NSA has claimed that they do not directly filter traffic or receive malicious code 
! captured by Internet providers. It is unclear how the Agency detects malicious code without 
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capturing it within the meaning of the Electronic Communications Privacy Act. 

EPIC's FOIA Request 

1 7. On July 26, 201 1 , EPIC transmitted, via facsimile, a written FOIA request to DHS 
for agency records. EPIC requested the following agency records: 

a) All contracts and communications with Lockheed Martin, CSC, SAIC, Northrop Grumman 
or other defense contractors regarding the new NSA pilot program; 

b) All contracts and communications with AT&T, Verizon, and CenturyLink or any other IPSs 
[sic] regarding the new NSA pilot program; 

c) All analyses, legal memoranda, and related records regarding the new NSA pilot program; 

I d) Any memoranda of understanding between NSA and DHS or any other government 
agencies or corporations regarding the new NSA pilot program; 

e) Any privacy impact assessment performed as part of the development of the new NSA pilot 
program. 

18. EPIC requested "News Media" fee status under the Freedom of Information Act 
; based on EPIC's status as a representative of the news media. 

1 9. EPIC's FOIA Request further requested waiver of all duplication fees. 

20. Disclosure of the records requested in EPIC's FOIA Request will contribute 
significantly to public understanding of the operations and activities of the government. 

21. In a letter dated August 3, 201 1 , DHS acknowledged EPIC's FOIA Request. 

22. In the Agency's acknowledgment, DHS responded that the agency had conducted a 
search and been unable to identify or locate any records responsive to category 5 of EPIC's FOIA 

; Request (category (e) above). DHS notified EPIC of the right to appeal this determination. 

; 23. DHS also notified EPIC that the agency had referred EPIC's FOIA Request to the 

DHS National Protection and Programs Directorate ("NPPD"") for further processing and direct 

response. 
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24. DHS assigned EPIC's FOIA Request reference number DHS/OS/PRIV 11 - 11 04. 

25. EPIC received no communications from NPPD in regard to EPIC's FOIA Request. 

26. On January 5, 201 1 , EPIC transmitted via facsimile an administrative appeal to the 
NPPD ("EPIC's Administrative Appeal") appealing the NPPD's non-responsiveness to categories 
1-4 of EPIC's FOIA Request (categories (a)-(d) above). 

27. EPIC ' s Administrative Appeal noted the reference number assigned to EPIC ' s FOIA 
Request by DHS. 

28. EPIC's Administrative Appeal renewed EPIC's request for "News Media" fee status 
and a waiver of all duplication fees. 

29. On January 23, 201 2, a FOIA Agent with NPPD contacted EPIC by telephone. 

30. NPPD's FOIA Agent indicated that she would "start processing" EPIC's FOIA 
Request. 

3 1 . EPIC has never received an official acknowledgement of EPIC s FOIA Request by 

NPPD. 

32. Through the date of this pleading, DHS has not made a single determination 
concerning the substance of categories 1-4 of EPIC's FOIA Request. 

33 . Through the date of this pleading, DHS has failed to produce any documents in 
response to EPIC's FOIA Request. 

Count I 

Violation of the FOIA: Failure to Comply With Statutory Deadlines and 
Wrongful Withholding of Agency Records in Regard to EPIC's FOIA Request 

34. Paragraphs 1-33 above are hereby incorporated by reference as if set forth fully 

herein. 

35. DHS' response to EPIC's FOIA Request violated the statutory deadlines imposed 
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by the FOIA, including the deadlines set forth in 5 U.S.C. § 552(a)(6)(A). 

36. DHS has wrongly withheld responsive agency records from EPIC. 

37. EPIC has exhausted the applicable administrative remedies with respect to EPIC's 
: FOIA Request. 

38. EPIC is entitled to injunctive relief compelling the release and disclosure of the 
requested agency records. 

Requested Relief 

WHEREFORE, Plaintiff prays that this Court: 

A. order Defendant to conduct an adequate search for agency records responsive to 
EPIC's FOIA Request within five working days of the date of the Court's Order 
in this matter; 

B. order Defendant to make a complete determination regarding EPIC's FOIA 
Request within ten days of the date of the Court's Order in this matter; 

C. order Defendant to disclose all responsive agency records to EPIC's FOIA 
Request within ten days of the Court's Order in this matter; 

D. award Plaintiff its costs and reasonable attorneys' fees incurred in this action 
pursuant to 5 U.S.C. § 552(a)(4)(E); and 

E. grant such other relief as the Court may deem just and proper. 
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Respectfully submitted, 

By: ^ /flff l 

John /erdi, Esquire (DC Bar # 495764) 
Maxc Rotenberg, Esquire (DC Bar # 422825) 
Amie Stepanovich, Esquire 
ELECTRONIC PRIVACY INFORMATION 
CENTER 

1718 Connecticut Avenue, N.W. 
Suite 200 

Washington, D.C. 20009 
(202) 483-1140 (telephone) 
(202) 483-1248 (facsimile) 

Dated: March 1,2012 



i * 

j Amie Stepanovich is barred in New York State. Her application for admission in the District of 
I Columbia is pending. 
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